PT-2016-7836 · Joomla · Joomla! Cms

Publicado 2016-12-05 · Atualizado 2016-12-07 · CVE-2016-9836

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joomla! CMS versions prior to 3.6.5

Description The issue concerns the file scanning mechanism in Joomla! CMS, specifically the JFilterInput::isFileSafe() function, which fails to account for alternative PHP file extensions when checking uploaded files for PHP content. This allows users to upload and execute files with extensions such as .php6, .php7, .phtml, and .phpt. Furthermore, the JHelperMedia::canUpload() function did not properly blacklist these file extensions as uploadable file types.

Recommendations For versions prior to 3.6.5, update to version 3.6.5 or later to resolve the issue.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-9836

Produtos afetados

Joomla! Cms

Referências · 5

• 🔥 https://github.com/XiphosResearch/exploits/tree/master/Joomraa · Exploit
• https://osv.dev/vulnerability/CVE-2016-9836 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9836 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-9836 · Nota de Segurança
• http://securityfocus.com/bid/94663 · Nota